wyoranchhand Posted October 30, 2023 ID:1597368 Share Posted October 30, 2023 I had a detection notice pop up today. An RPT detection with the event details of Exploit.PayloadProccessBlock. Something was trying to execute powershell commands. According to the detection history it also happened 8 days ago. I ran a full scan with Malwarebytes and Widows defender and found nothing. I also ran MSERT and it found and fixed what I believe were Window Defender config issues. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Porthos Posted October 30, 2023 ID:1597372 Share Posted October 30, 2023 @wyoranchhand Let's get the info to get the process started. Please do the following so that we may take a closer look at your system for any possible infections. Do these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start. Show-Hidden-Folders-Files-Extensions https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/ Disable-Fast-Startup https://forums.malwarebytes.com/topic/299350-disable-fast-startup/ Then please restart the computer and do the following. WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download the Malwarebytes Support Tool In your Downloads folder, open the mb-support-x.x.x.xxx.exe file In the User Account Control pop-up window, click Yes to continue the installation Run the MBST Support Tool In the left navigation pane of the Malwarebytes Support Tool, click Advanced In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply Then be patient for the next expert to take your case. Thank you Link to post Share on other sites More sharing options...
wyoranchhand Posted October 30, 2023 Author ID:1597382 Share Posted October 30, 2023 mbst-grab-results.zip Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 30, 2023 Root Admin ID:1597406 Share Posted October 30, 2023 Hello @wyoranchhand Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop. (Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021) Download: Kaspersky Virus Removal Tool https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe How to run a scan with Kaspersky Virus Removal Tool 2020 https://support.kaspersky.com/15674 How to run Kaspersky Virus Removal Tool 2020 in the advanced mode https://support.kaspersky.com/15680 How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan https://support.kaspersky.com/15681 Select the Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box. That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed... Thank you Link to post Share on other sites More sharing options...
wyoranchhand Posted October 30, 2023 Author ID:1597424 Share Posted October 30, 2023 If you want ALL the boxes checked this is going to take a bit. Link to post Share on other sites More sharing options...
wyoranchhand Posted October 30, 2023 Author ID:1597443 Share Posted October 30, 2023 report_2023.10.30_13.24.25.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 30, 2023 Root Admin ID:1597459 Share Posted October 30, 2023 Nothing found. Let's go ahead and try another scanner from Microsoft Microsoft Safety Scanner Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan. That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well STEP 1 Please set File Explorer to SHOW ALL folders, all files, including hidden ones. Use OPTION ONE or TWO of this article https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html STEP 2 I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer. The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. The download links & the how-to-run-the tool are at this link at Microsoft https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download Look on the Scan Options & select the FULL scan. Then start the scan. Have lots of patience. It may take several hours. Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on the screen display. The only things that count are the End result at the end of the run. The scan will take several hours. Leave it alone. It will remove any other remaining threats as it goes along. Take a very long break, do your normal personal errands .....just do not use the computer during this scan. This is likely to run for many hours as previously mentioned ( depending on the number of files on your machine & the speed of the hardware.) The log is named MSERT.log and the log will be at C:\Windows\debug\msert.log Please attach that log with your next reply. It is normal for the Microsoft Safety Scanner to show detections during the scan process. It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection. That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not. Then it writes into the log on your computer what it found. Thank you Link to post Share on other sites More sharing options...
wyoranchhand Posted October 31, 2023 Author ID:1597468 Share Posted October 31, 2023 1000 years later. msert.log Link to post Share on other sites More sharing options...
wyoranchhand Posted October 31, 2023 Author ID:1597469 Share Posted October 31, 2023 I had run MSERT earlier today and it found DefenderTamperingRestore issue. Isn't that just a Windows Defender configuration issue? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 31, 2023 Root Admin ID:1597475 Share Posted October 31, 2023 Please make the following change in Malwarebytes if you're using the Premium or Trial version Please open Malwarebytes. Click on the small gear icon to open the Settings and go to the Security tab. Then turn off "Always register Malwarebytes in the Windows Security Center" Restart the computer It is highly unlikely that you need to setup exclusions for Windows Defender, however if you experience any issues, please see the following article and setup exclusions between Malwarebytes and Windows Defender Malwarebytes for Windows antivirus exclusions list https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list Then restart the computer and let me know if you're still getting block alerts Link to post Share on other sites More sharing options...
wyoranchhand Posted October 31, 2023 Author ID:1597477 Share Posted October 31, 2023 I already have that setting turned off. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 31, 2023 Root Admin ID:1597483 Share Posted October 31, 2023 1 hour ago, AdvancedSetup said: Then restart the computer and let me know if you're still getting block alerts Link to post Share on other sites More sharing options...
wyoranchhand Posted October 31, 2023 Author ID:1597486 Share Posted October 31, 2023 It's not doing every time I restart. Whatever it is tried to execute about 30 powershell scripts at once today and 8 days ago it did the same. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 31, 2023 Root Admin ID:1597496 Share Posted October 31, 2023 Let's go ahead and run a couple of scans and get some updated logs from your system. Please make the following changes. Temporarily disable your antivirus real-time protection or other security software first if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed. Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the scans are completed. Disable-Fast-Startup Show-Hidden-Folders-Files-Extensions Next, run these steps and post back the logs as an attachment when ready. [ 1 ] Malwarebytes for Windows If you already have Malwarebytes installed then open Malwarebytes and click on the small gear icon, then click on the "Check for updates" button on the General tab. After any updates, click the middle Scan button from the main page. It will automatically run a Threat Scan. If you don't have Malwarebytes installed yet please download it from here and install it. Once installed then open Malwarebytes and select Scan and let it run. Once the scan is completed, make sure you have it quarantine any detections it finds. If no detections were found click on the Save results drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply. If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply. If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let us know in your next reply that the scanner would not run. [ 2 ] Malwarebytes AdwCleaner Please download Malwarebytes AdwCleaner and save the file to your Desktop or Downloads folder. Double-click to run the program - Malwarebytes AdwCleaner guide Accept the End User License Agreement. Wait until the database is updated. Click Scan Now. DO NOT uninstall or remove the Preinstalled software if found. Uncheck any items listed as Preinstalled When finished, if items are found please click Quarantine to finish the cleaning process. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Attach that log to your next reply. If No Detections are found, Click Skip Basic Repair WARNING: Do Not click the Run Basic Repair button unless instructed to by a Malwarebytes support agent or authorized helper RESTART THE COMPUTER Before running Step 3 [ 3 ] Gather MBST Logs Please do the following so that we may take a closer look at your system for any possible infections. NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download the Malwarebytes Support Tool In your Downloads folder, open the mb-support-x.x.x.xxx.exe file In the User Account Control pop-up window, click Yes to continue the installation Run the MBST Support Tool In the left navigation pane of the Malwarebytes Support Tool, click Advanced In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply WARNING: Do Not click the Repair System under Advanced unless requested to by a Malwarebytes support agent or authorized helper Thank you Link to post Share on other sites More sharing options...
wyoranchhand Posted October 31, 2023 Author ID:1597569 Share Posted October 31, 2023 mb103123scan.txt AdwCleaner[S00].txt mbst-grab-results.zip Link to post Share on other sites More sharing options...
wyoranchhand Posted October 31, 2023 Author ID:1597570 Share Posted October 31, 2023 I has come to my attention that a change was made to this computer after the rpt detection. Revo uninstaller was downloaded and Folder Locker was uninstalled. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 31, 2023 Root Admin ID:1597622 Share Posted October 31, 2023 If you've not made these changes yourself then it's probably best that you back up your personal data only, to an external USB hard drive. Then do a CLEAN install of Windows Clean Install Windows 10 & 11 (2023) https://answers.microsoft.com/en-us/windows/forum/all/clean-install-windows-10-11-2023/1c426bdf-79b1-4d42-be93-17378d93e587 Also, please review the following topic Bypass Microsoft Online Account Creation during installation of Windows 11 https://forums.malwarebytes.com/topic/296613-bypass-microsoft-online-account-creation-during-installation-of-windows-11/ Link to post Share on other sites More sharing options...
wyoranchhand Posted October 31, 2023 Author ID:1597628 Share Posted October 31, 2023 I didn't do it but someone in the household did. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 31, 2023 Root Admin ID:1597668 Share Posted October 31, 2023 Okay, as long as you know who did it that makes it understandable as the logs do not show any type of obvious remote access control going on. We can run some more clean up scripts if you like, let me know. If you'd rather do a clean install of Windows that too is a good option Link to post Share on other sites More sharing options...
wyoranchhand Posted November 1, 2023 Author ID:1597800 Share Posted November 1, 2023 I'd like to find out what's going and fix it. This is mostly a gaming pc and I really don't want to re download 800GB of games. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 1, 2023 Root Admin ID:1597857 Share Posted November 1, 2023 Please get me a new set of logs. NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download the Malwarebytes Support Tool In your Downloads folder, open the mb-support-x.x.x.xxx.exe file In the User Account Control pop-up window, click Yes to continue the installation Run the MBST Support Tool In the left navigation pane of the Malwarebytes Support Tool, click Advanced In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply Thank you Link to post Share on other sites More sharing options...
wyoranchhand Posted November 2, 2023 Author ID:1597954 Share Posted November 2, 2023 mbst-grab-results.zip Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 2, 2023 Root Admin ID:1598011 Share Posted November 2, 2023 Please run the following fix NOTE: Please read all of the information below before running this fix. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone. Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply Farbar program: FRSTEnglish.exe Save the attached file: FIXLIST.TXT to this folder C:\Users\Ladd\Downloads\ NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work. Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it. Run the Farbar program with Admin rights and press the Fix button just once and wait. The fix may possibly take up to 60 minutes to complete If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply. NOTE: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed. Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix. The following directories are emptied: Windows Temp Users Temp folders Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Discord cache Java cache Steam HTML cache Explorer thumbnail and icon cache BITS transfer queue (qmgr*.dat files) Recycle Bin Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix. The system will be rebooted after the fix has run. fixlist.txt Thanks Link to post Share on other sites More sharing options...
wyoranchhand Posted November 2, 2023 Author ID:1598030 Share Posted November 2, 2023 Fixlog.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 2, 2023 Root Admin ID:1598042 Share Posted November 2, 2023 Great, that log ran well and also found and fixed some other issues Windows Resource Protection found corrupt files and successfully repaired them. Please run the following SecurityCheck by glax24 I would like you to run a tool named SecurityCheck to inquire about the current security update status of some applications. CheckSecurity is a utility for quickly checking for the presence of vulnerable applications Temporarily disable Microsoft SmartScreen to download the software Download SecurityCheck by glax24: https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe If SmartScreen blocks the file from running click on More info and Run anyway This tool is safe. Smartscreen is overly sensitive. You can check the VirusTotal scan of the tool from here Right-click with your mouse on the Securitycheck.exe and select "Run as administrator" and reply YES to allow to run & go forward Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file. Attach it with your next reply. You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt Checked parameters: User Account Control (UAC). Service pack. IE version. Automatic OS update. Sets of critical KB patches when updating is disabled. Antivirus, firewall, other security utilities. Versions of Java, Oracle Virtualbox. Version of Adobe Flash Player, Adobe AIR. Versions of Adobe Reader, Acrobat Reader DC, Foxit Reader. Versions of media players (iTunes, AIMP, foobar2000). Versions of messengers (Skype, Pidgin). Versions of installed browsers (Chrome, Opera, Firefox, Yandex, SeaMonkey). Versions of mail programs (The Bat, Thunderbird). Checking running processes and security program services Searching for installed Adware programs and optimizer programs (More than 5000). Thank you Link to post Share on other sites More sharing options...
Recommended Posts